Detecting when a Honypot is accessed is important to detect lateral movement across your environment. We recommend that SIEMs should be tested for honeypot detection to ensure the detection of lateral movement which could originate from both employees and external bad actors.
How to Test Your Honeypot for Lateral Movement via FTP Auth
Prerequisites
Blumira Sensor is deployed
Honeypot Module is configured
FTP Test
Open a CMD Prompt as an Administrator that can communicate with the sensor over port 21
Type the following:
FTP
open<ip_address of the sensor>
Add in username & password
Within minutes, a finding (alert) will populate in the responder dashboard in Blumira
